Palo Alto Networks Unit 42 researchers unveiled a new phishing campaign named NodeStealer 2.0, aimed at Facebook business accounts.
The campaign entices victims with free business tools, like spreadsheet templates, to completely take over the accounts. This strategy indicates a concerning trend among threat actors, who have been increasingly targeting Facebook business accounts which emerged around July 2022.
Meta released a report on NodeStealer, a new information-stealing malware initially compiled in July 2022.
The report highlighted malicious activities involving NodeStealer that were identified in January 2023. In December 2022, a campaign featuring a new version of Nodestealer emerged. This new campaign involved two Python-written variants with enhanced capabilities, including cryptocurrency theft, downloading abilities, and a complete takeover of Facebook business accounts.
The main infection vector was a phishing campaign focusing on advertising materials for businesses, allowing threat actors to steal browser cookies to hijack accounts on the platform, specifically aiming toward business accounts.
The threat actor used multiple Facebook pages and users to post information, luring victims to download links from known cloud file storage providers. After clicking on it, a ZIP file was downloaded to the machine containing the malicious info stealer executable.
“In early 2023, Meta reported it has reached 80.30 million Facebook users in the Philippines, equivalent to 69.0 percent of the total population at the start of the year,” said Vicky Ray, director at Unit 42 Cyber Consulting and Threat Intelligence, Asia Pacific and Japan at Palo Alto Networks.
“This extensive presence potentially exposes the country to considerable risks from NodeStealer, which greatly threatens individuals and organizations. Besides the direct impact on Facebook business accounts, which is mainly financial, the malware also steals credentials from browsers, which can be used for further attacks. We encourage all organisations to review their protection policies and use the indicators of compromise (IoCs) provided in this report to address this threat,” said Ray.
Facebook business account owners are encouraged to use strong, complex, hard-to-guess passwords and enable multifactor authentication.